

<!DOCTYPE html>
<html lang="zh-CN" data-default-color-scheme=auto>



<head>
  <meta charset="UTF-8">
  <link rel="apple-touch-icon" sizes="76x76" href="/img/favicon.png">
  <link rel="icon" href="/img/favicon.png">
  <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5.0, shrink-to-fit=no">
  <meta http-equiv="x-ua-compatible" content="ie=edge">
  
  <meta name="theme-color" content="#2f4154">
  <meta name="author" content="Fly542">
  <meta name="keywords" content="">
  
    <meta name="description" content="引言在c&#x2F;c++开发中，内存相关错误一直都是开发人员的高压线，由于近期工作中上线服务偶尔出现崩溃问题，而崩溃的位置竟然是在 malloc函数的内部（见下图1），看到崩溃的第一反应是自己的程序出了问题，glibc使用多年还是很稳定的。于是先进行了一波代码自查，检查了程序中所有的memcpy、strcpy、memset、sprintf函数的使用并未发现异常，于是放弃人工检查，改为使用工具来进行定位分析">
<meta property="og:type" content="article">
<meta property="og:title" content="如何在生产环境中追踪运行态内存崩溃的第一现场">
<meta property="og:url" content="http://fly542.cn/2023/10/07/03%E8%BD%AF%E4%BB%B6%E5%BC%80%E5%8F%91/01c_cpp/16%E5%A6%82%E4%BD%95%E5%9C%A8%E7%94%9F%E4%BA%A7%E7%8E%AF%E5%A2%83%E4%B8%AD%E8%BF%BD%E8%B8%AA%E8%BF%90%E8%A1%8C%E6%80%81%E5%86%85%E5%AD%98%E5%B4%A9%E6%BA%83%E7%9A%84%E7%AC%AC%E4%B8%80%E7%8E%B0%E5%9C%BA/index.html">
<meta property="og:site_name" content="Fly542 技术沉淀">
<meta property="og:description" content="引言在c&#x2F;c++开发中，内存相关错误一直都是开发人员的高压线，由于近期工作中上线服务偶尔出现崩溃问题，而崩溃的位置竟然是在 malloc函数的内部（见下图1），看到崩溃的第一反应是自己的程序出了问题，glibc使用多年还是很稳定的。于是先进行了一波代码自查，检查了程序中所有的memcpy、strcpy、memset、sprintf函数的使用并未发现异常，于是放弃人工检查，改为使用工具来进行定位分析">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="http://fly542.cn/2023/10/07/03%E8%BD%AF%E4%BB%B6%E5%BC%80%E5%8F%91/01c_cpp/16%E5%A6%82%E4%BD%95%E5%9C%A8%E7%94%9F%E4%BA%A7%E7%8E%AF%E5%A2%83%E4%B8%AD%E8%BF%BD%E8%B8%AA%E8%BF%90%E8%A1%8C%E6%80%81%E5%86%85%E5%AD%98%E5%B4%A9%E6%BA%83%E7%9A%84%E7%AC%AC%E4%B8%80%E7%8E%B0%E5%9C%BA/20191211094630--10.25.7.132.png">
<meta property="og:image" content="http://fly542.cn/2023/10/07/03%E8%BD%AF%E4%BB%B6%E5%BC%80%E5%8F%91/01c_cpp/16%E5%A6%82%E4%BD%95%E5%9C%A8%E7%94%9F%E4%BA%A7%E7%8E%AF%E5%A2%83%E4%B8%AD%E8%BF%BD%E8%B8%AA%E8%BF%90%E8%A1%8C%E6%80%81%E5%86%85%E5%AD%98%E5%B4%A9%E6%BA%83%E7%9A%84%E7%AC%AC%E4%B8%80%E7%8E%B0%E5%9C%BA/gcc4.8_ldd.png">
<meta property="og:image" content="http://fly542.cn/2023/10/07/03%E8%BD%AF%E4%BB%B6%E5%BC%80%E5%8F%91/01c_cpp/16%E5%A6%82%E4%BD%95%E5%9C%A8%E7%94%9F%E4%BA%A7%E7%8E%AF%E5%A2%83%E4%B8%AD%E8%BF%BD%E8%B8%AA%E8%BF%90%E8%A1%8C%E6%80%81%E5%86%85%E5%AD%98%E5%B4%A9%E6%BA%83%E7%9A%84%E7%AC%AC%E4%B8%80%E7%8E%B0%E5%9C%BA/gcc5.3_ldd.png">
<meta property="og:image" content="http://fly542.cn/2023/10/07/03%E8%BD%AF%E4%BB%B6%E5%BC%80%E5%8F%91/01c_cpp/16%E5%A6%82%E4%BD%95%E5%9C%A8%E7%94%9F%E4%BA%A7%E7%8E%AF%E5%A2%83%E4%B8%AD%E8%BF%BD%E8%B8%AA%E8%BF%90%E8%A1%8C%E6%80%81%E5%86%85%E5%AD%98%E5%B4%A9%E6%BA%83%E7%9A%84%E7%AC%AC%E4%B8%80%E7%8E%B0%E5%9C%BA/gcc8.3_ldd.png">
<meta property="og:image" content="http://fly542.cn/2023/10/07/03%E8%BD%AF%E4%BB%B6%E5%BC%80%E5%8F%91/01c_cpp/16%E5%A6%82%E4%BD%95%E5%9C%A8%E7%94%9F%E4%BA%A7%E7%8E%AF%E5%A2%83%E4%B8%AD%E8%BF%BD%E8%B8%AA%E8%BF%90%E8%A1%8C%E6%80%81%E5%86%85%E5%AD%98%E5%B4%A9%E6%BA%83%E7%9A%84%E7%AC%AC%E4%B8%80%E7%8E%B0%E5%9C%BA/gcc4.8_asan_help.png">
<meta property="og:image" content="http://fly542.cn/2023/10/07/03%E8%BD%AF%E4%BB%B6%E5%BC%80%E5%8F%91/01c_cpp/16%E5%A6%82%E4%BD%95%E5%9C%A8%E7%94%9F%E4%BA%A7%E7%8E%AF%E5%A2%83%E4%B8%AD%E8%BF%BD%E8%B8%AA%E8%BF%90%E8%A1%8C%E6%80%81%E5%86%85%E5%AD%98%E5%B4%A9%E6%BA%83%E7%9A%84%E7%AC%AC%E4%B8%80%E7%8E%B0%E5%9C%BA/image2020-1-3_13-53-13.png">
<meta property="og:image" content="http://fly542.cn/2023/10/07/03%E8%BD%AF%E4%BB%B6%E5%BC%80%E5%8F%91/01c_cpp/16%E5%A6%82%E4%BD%95%E5%9C%A8%E7%94%9F%E4%BA%A7%E7%8E%AF%E5%A2%83%E4%B8%AD%E8%BF%BD%E8%B8%AA%E8%BF%90%E8%A1%8C%E6%80%81%E5%86%85%E5%AD%98%E5%B4%A9%E6%BA%83%E7%9A%84%E7%AC%AC%E4%B8%80%E7%8E%B0%E5%9C%BA/image2020-1-3_13-50-10.png">
<meta property="article:published_time" content="2023-10-07T03:53:31.000Z">
<meta property="article:modified_time" content="2024-10-31T07:22:35.249Z">
<meta property="article:author" content="Fly542">
<meta property="article:tag" content="c++">
<meta property="article:tag" content="c">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:image" content="http://fly542.cn/2023/10/07/03%E8%BD%AF%E4%BB%B6%E5%BC%80%E5%8F%91/01c_cpp/16%E5%A6%82%E4%BD%95%E5%9C%A8%E7%94%9F%E4%BA%A7%E7%8E%AF%E5%A2%83%E4%B8%AD%E8%BF%BD%E8%B8%AA%E8%BF%90%E8%A1%8C%E6%80%81%E5%86%85%E5%AD%98%E5%B4%A9%E6%BA%83%E7%9A%84%E7%AC%AC%E4%B8%80%E7%8E%B0%E5%9C%BA/20191211094630--10.25.7.132.png">
  
  
  <title>如何在生产环境中追踪运行态内存崩溃的第一现场 - Fly542 技术沉淀</title>

  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@4/dist/css/bootstrap.min.css" />


  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/github-markdown-css@4/github-markdown.min.css" />
  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hint.css@2/hint.min.css" />

  
    
    
      
      <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/highlight.js@10/styles/github-gist.min.css" />
    
  

  
    <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fancyapps/fancybox@3/dist/jquery.fancybox.min.css" />
  


<!-- 主题依赖的图标库，不要自行修改 -->

<link rel="stylesheet" href="//at.alicdn.com/t/font_1749284_ba1fz6golrf.css">



<link rel="stylesheet" href="//at.alicdn.com/t/font_1736178_lbnruvf0jn.css">


<link  rel="stylesheet" href="/css/main.css" />

<!-- 自定义样式保持在最底部 -->


  <script id="fluid-configs">
    var Fluid = window.Fluid || {};
    var CONFIG = {"hostname":"fly542.cn","root":"/","version":"1.8.14","typing":{"enable":true,"typeSpeed":70,"cursorChar":"_","loop":false},"anchorjs":{"enable":true,"element":"h1,h2,h3,h4,h5,h6","placement":"right","visible":"hover","icon":""},"progressbar":{"enable":true,"height_px":3,"color":"#29d","options":{"showSpinner":false,"trickleSpeed":100}},"copy_btn":true,"image_zoom":{"enable":true,"img_url_replace":["",""]},"toc":{"enable":true,"headingSelector":"h1,h2,h3,h4,h5,h6","collapseDepth":0},"lazyload":{"enable":true,"loading_img":"/img/loading.gif","onlypost":false,"offset_factor":2},"web_analytics":{"enable":false,"baidu":null,"google":null,"gtag":null,"tencent":{"sid":null,"cid":null},"woyaola":null,"cnzz":null,"leancloud":{"app_id":null,"app_key":null,"server_url":null,"path":"window.location.pathname","ignore_local":false}},"search_path":"/local-search.xml"};
  </script>
  <script  src="/js/utils.js" ></script>
  <script  src="/js/color-schema.js" ></script>
<meta name="generator" content="Hexo 6.0.0"></head>


<body>
  <header style="height: 70vh;">
    <nav id="navbar" class="navbar fixed-top  navbar-expand-lg navbar-dark scrolling-navbar">
  <div class="container">
    <a class="navbar-brand" href="/">
      <strong>Fly542 技术沉淀</strong>
    </a>

    <button id="navbar-toggler-btn" class="navbar-toggler" type="button" data-toggle="collapse"
            data-target="#navbarSupportedContent"
            aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
      <div class="animated-icon"><span></span><span></span><span></span></div>
    </button>

    <!-- Collapsible content -->
    <div class="collapse navbar-collapse" id="navbarSupportedContent">
      <ul class="navbar-nav ml-auto text-center">
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/">
                <i class="iconfont icon-home-fill"></i>
                首页
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/archives/">
                <i class="iconfont icon-archive-fill"></i>
                归档
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/categories/">
                <i class="iconfont icon-category-fill"></i>
                分类
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/tags/">
                <i class="iconfont icon-tags-fill"></i>
                标签
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/about/">
                <i class="iconfont icon-user-fill"></i>
                关于
              </a>
            </li>
          
        
        
          <li class="nav-item" id="search-btn">
            <a class="nav-link" target="_self" href="javascript:;" data-toggle="modal" data-target="#modalSearch" aria-label="Search">
              &nbsp;<i class="iconfont icon-search"></i>&nbsp;
            </a>
          </li>
        
        
          <li class="nav-item" id="color-toggle-btn">
            <a class="nav-link" target="_self" href="javascript:;" aria-label="Color Toggle">&nbsp;<i
                class="iconfont icon-dark" id="color-toggle-icon"></i>&nbsp;</a>
          </li>
        
      </ul>
    </div>
  </div>
</nav>

    <div class="banner" id="banner" parallax=true
         style="background: url('/img/default.png') no-repeat center center;
           background-size: cover;">
      <div class="full-bg-img">
        <div class="mask flex-center" style="background-color: rgba(0, 0, 0, 0.3)">
          <div class="page-header text-center fade-in-up">
            <span class="h2" id="subtitle" title="如何在生产环境中追踪运行态内存崩溃的第一现场">
              
            </span>

            
              <div class="mt-3">
  
  
    <span class="post-meta">
      <i class="iconfont icon-date-fill" aria-hidden="true"></i>
      <time datetime="2023-10-07 11:53" pubdate>
        2023年10月7日 中午
      </time>
    </span>
  
</div>

<div class="mt-1">
  
    <span class="post-meta mr-2">
      <i class="iconfont icon-chart"></i>
      20k 字
    </span>
  

  
    <span class="post-meta mr-2">
      <i class="iconfont icon-clock-fill"></i>
      
      
      164 分钟
    </span>
  

  
  
</div>

            
          </div>

          
        </div>
      </div>
    </div>
  </header>

  <main>
    
      

<div class="container-fluid nopadding-x">
  <div class="row nomargin-x">
    <div class="d-none d-lg-block col-lg-2"></div>
    <div class="col-lg-8 nopadding-x-md">
      <div class="container nopadding-x-md" id="board-ctn">
        <div class="py-5" id="board">
          <article class="post-content mx-auto">
            <!-- SEO header -->
            <h1 style="display: none">如何在生产环境中追踪运行态内存崩溃的第一现场</h1>
            
            <div class="markdown-body">
              <h1 id="引言"><a href="#引言" class="headerlink" title="引言"></a>引言</h1><p>在c/c++开发中，内存相关错误一直都是开发人员的高压线，由于近期工作中上线服务偶尔出现崩溃问题，而崩溃的位置竟然是在 malloc函数的内部（见下图1），看到崩溃的第一反应是自己的程序出了问题，glibc使用多年还是很稳定的。于是先进行了一波代码自查，检查了程序中所有的memcpy、strcpy、memset、sprintf函数的使用并未发现异常，于是放弃人工检查，改为使用工具来进行定位分析。</p>
<img src="/2023/10/07/03%E8%BD%AF%E4%BB%B6%E5%BC%80%E5%8F%91/01c_cpp/16%E5%A6%82%E4%BD%95%E5%9C%A8%E7%94%9F%E4%BA%A7%E7%8E%AF%E5%A2%83%E4%B8%AD%E8%BF%BD%E8%B8%AA%E8%BF%90%E8%A1%8C%E6%80%81%E5%86%85%E5%AD%98%E5%B4%A9%E6%BA%83%E7%9A%84%E7%AC%AC%E4%B8%80%E7%8E%B0%E5%9C%BA/20191211094630--10.25.7.132.png" srcset="/img/loading.gif" lazyload class="">


<h1 id="工具选择"><a href="#工具选择" class="headerlink" title="工具选择"></a>工具选择</h1><p>在众多内存检测工具中，各有优缺点，需要结合实际情况来选择定位，</p>
<h2 id="常见的内存错误有以下几种类型"><a href="#常见的内存错误有以下几种类型" class="headerlink" title="常见的内存错误有以下几种类型"></a>常见的内存错误有以下几种类型</h2><table>
<thead>
<tr>
<th>memory overrun</th>
<th>内存溢出</th>
</tr>
</thead>
<tbody><tr>
<td>double free</td>
<td>同一内存多次释放</td>
</tr>
<tr>
<td>use after free</td>
<td>内存释放后再次使用</td>
</tr>
<tr>
<td>wild free</td>
<td>释放内存的参数为非法值</td>
</tr>
<tr>
<td>access uninitialized memory</td>
<td>访问未初始化内存</td>
</tr>
<tr>
<td>memory leak</td>
<td>内存泄露</td>
</tr>
<tr>
<td>use after return</td>
<td>函数返回栈内指针</td>
</tr>
<tr>
<td>stack overflow</td>
<td>栈溢出</td>
</tr>
</tbody></table>
<h2 id="常规的内存错误检测工具及其支持的功能对比"><a href="#常规的内存错误检测工具及其支持的功能对比" class="headerlink" title="常规的内存错误检测工具及其支持的功能对比"></a>常规的内存错误检测工具及其支持的功能对比</h2><table>
<thead>
<tr>
<th></th>
<th><strong>memory overrun</strong></th>
<th><strong>double free</strong></th>
<th><strong>use after free</strong></th>
<th><strong>wild free</strong></th>
<th><strong>access uninited</strong></th>
<th><strong>read invalid memory</strong></th>
<th><strong>memory leak</strong></th>
<th><strong>use after return</strong></th>
<th><strong>stack overflow</strong></th>
<th><strong>thread safe</strong></th>
<th><strong>Performance</strong></th>
</tr>
</thead>
<tbody><tr>
<td>Memory checking tools in Glibc</td>
<td></td>
<td>Yes</td>
<td></td>
<td>Yes</td>
<td></td>
<td></td>
<td>Yes</td>
<td></td>
<td>Yes(if use memcpy, strcpy, etc)</td>
<td></td>
<td></td>
</tr>
<tr>
<td>TCMalloc(Gperftools)</td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td>Yes</td>
<td></td>
<td></td>
<td>Yes</td>
<td></td>
</tr>
<tr>
<td>Valgrind</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>官方文档说明 为 40X</td>
</tr>
<tr>
<td>Address Sanitizer(ASan)</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>(Memory Sanitizer)</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>官方文档说明 2x，平均1.8x</td>
</tr>
<tr>
<td>Memwatch</td>
<td></td>
<td>Yes</td>
<td></td>
<td>Yes</td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td>NO</td>
<td></td>
</tr>
<tr>
<td>Dr.Memory</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Electric Fence</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td>NO</td>
<td></td>
</tr>
<tr>
<td>Dmalloc</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td></td>
<td></td>
<td>Yes</td>
<td></td>
<td></td>
<td>Yes</td>
<td></td>
</tr>
</tbody></table>
<h2 id="我们的需求"><a href="#我们的需求" class="headerlink" title="我们的需求"></a>我们的需求</h2><ul>
<li><p>线程安全</p>
</li>
<li><p>测试很难复现，需要线上运行程序，所以性能差异不要太大</p>
</li>
<li><p>需要尽可能多的检测出相关未知内存错误</p>
</li>
</ul>
<p>从以上对比分析中来看Address Sanitizer(ASan) 是可以比较全面的检测发现内存等相关问题，且运行时性能损失较小，因此重点研究了Address Sanitizer 的相关用法，其他的tcmalloc和MALLOC_CHECK_ 等也做了相关功能对比测试，Address Sanitizer  确实对各种内存相关问题检测比较全面，且对程序运行时的性能影响相对较小，官方说2x的性能下降，因此决定使用Address Sanitizer来进行相关异常的定位检测。</p>
<h1 id="Address-Sanitizer的使用研究"><a href="#Address-Sanitizer的使用研究" class="headerlink" title="Address Sanitizer的使用研究"></a>Address Sanitizer的使用研究</h1><h2 id="介绍"><a href="#介绍" class="headerlink" title="介绍"></a>介绍</h2><p>Sanitizer 是google开发的一套检测工具，包含AddressSanitizer, MemorySanitizer, ThreadSanitizer, LeakSanitizer 等，其中Address Sanitizer主要是用于检测地址寻址问题。主要通过libasan动态库在程序执行前替换系统的malloc函数来实现相关地址的检测功能。</p>
<p>Sanitizer 早先是LLVM中的特性，后被加入GCC 4.8中，在GCC 4.9后加入对ARM平台的支持。因此用时不需要第三方库，通过在编译时指定flag即可打开开关。因为gcc 4.8的Address Sanitizer还不完善，没有符号信息，所以最好使用gcc4.9以后的版本。</p>
<p>Sanitizer 项目地址： <a target="_blank" rel="noopener" href="https://github.com/google/sanitizers">https://github.com/google/sanitizers</a> </p>
<h2 id="使用-Address-Sanitizer-的注意点"><a href="#使用-Address-Sanitizer-的注意点" class="headerlink" title="使用 Address Sanitizer 的注意点"></a>使用 Address Sanitizer 的注意点</h2><ul>
<li>要使用系统自带的内存管理库，不能使用第三方的内存管理库，因为这个功能要拦截malloc,free等标准函数。</li>
<li>虽然Address Sanitizer是gcc的一部分，但默认是没有安装的，所以需要安装 libasan</li>
<li>不同版本的gcc使用不同版本的libasan， gcc版本和libasan版本对应关系见下图 </li>
<li>gcc4.8版对应的libasan不支持官方wiki中的相关动态参数，且没有符号信息</li>
</ul>
<table>
<thead>
<tr>
<th>gcc版本号</th>
<th>libasan版本名</th>
</tr>
</thead>
<tbody><tr>
<td>4.8/4.9</td>
<td>libasan-x.x</td>
</tr>
<tr>
<td>5.x</td>
<td>libasan2-x.x</td>
</tr>
<tr>
<td>6.x</td>
<td>libasan3-x.x</td>
</tr>
<tr>
<td>7.x</td>
<td>libasan4-x.x</td>
</tr>
<tr>
<td>8.x</td>
<td>libasan5-x.x</td>
</tr>
</tbody></table>
<h2 id="如何在程序中使用Sanitizer"><a href="#如何在程序中使用Sanitizer" class="headerlink" title="如何在程序中使用Sanitizer"></a>如何在程序中使用Sanitizer</h2><p>Sanitizer通用参数可参考 <a target="_blank" rel="noopener" href="https://github.com/google/sanitizers/wiki/SanitizerCommonFlags">https://github.com/google/sanitizers/wiki/SanitizerCommonFlags</a><br>AddressSanitizer参数可参考 <a target="_blank" rel="noopener" href="https://github.com/google/sanitizers/wiki/AddressSanitizerFlags">https://github.com/google/sanitizers/wiki/AddressSanitizerFlags</a></p>
<ol>
<li><p>在gcc或g++的编译选项中增加 -fsanitize=address -fno-omit-frame-pointer 编译选项以开启sanitize的使用</p>
 <figure class="highlight haml"><table><tr><td class="gutter"><div class="code-wrapper"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></div></td><td class="code"><pre><code class="hljs haml">-<span class="ruby">fsanitize=address    <span class="hljs-comment">#开启地址越界检查功能</span></span><br><span class="ruby"></span>-<span class="ruby">fno-omit-frame-pointer  <span class="hljs-comment">#开启后，可以打印详细的堆栈信息和符号表信息</span></span><br><span class="ruby"></span>如：g++ -g -fsanitize=address -fno-omit-frame-pointer main.cpp -o 	test<br></code></pre></td></tr></table></figure></li>
<li><p>在程序运行时指定 sanitize 依赖的环境变量 ASAN_OPTIONS 如下：</p>
 <figure class="highlight elixir"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><code class="hljs elixir">	如：export 	ASAN_OPTIONS=abort_on_error=<span class="hljs-number">1</span><span class="hljs-symbol">:disable_coredump=</span>0<span class="hljs-symbol">:unmap_shadow_on_exit=</span><span class="hljs-number">1</span><span class="hljs-symbol">:log_path=/tmp/proxy_ng_err</span><br>abort_on_error=<span class="hljs-number">1</span> <span class="hljs-comment"># 当遇到错误时调用abort而不是_exit来退出程序。默认为0，调用_exit</span><br>	disable_coredump=0 <span class="hljs-comment"># 0 开启检测异常时生成coredump文件；若要生效还需配合系统设置 ulimit -c unlimited; 默认为1，禁用coredump , </span><br>	unmap_shadow_on_exit=<span class="hljs-number">1</span> <span class="hljs-comment"># 是否在退出时调用unmap解除内存映射，默认0 不解除</span><br>	log_path=<span class="hljs-regexp">/tmp/proxy</span>_ng_err <span class="hljs-comment"># 将日志写入/tmp/proxy_ng_err.pid，pid为进程号， 默认输出至标准错误(strerr)</span><br></code></pre></td></tr></table></figure></li>
<li><p>官方文档说在程序代码中内嵌__asan_default_options 函数的实现，返回ASAN_OPTIONS期望设置的参数也可以起到类似设置环境变量的作用。<br>此方法本人在gcc4/gcc5/gcc6/gcc8中分别做了验证，各个环境下相关设置均未生效:(</p>
</li>
</ol>
<h2 id="如何验证当前编译程序是否开启了Address-Sanitizer检测"><a href="#如何验证当前编译程序是否开启了Address-Sanitizer检测" class="headerlink" title="如何验证当前编译程序是否开启了Address Sanitizer检测"></a>如何验证当前编译程序是否开启了Address Sanitizer检测</h2><ol>
<li><p>编写如下测试程序main2.cpp， 并使用如下命令生成可执行文件test_oom<br> g++ -g -fsanitize=address -fno-omit-frame-pointer main2.cpp -o test_oom</p>
 <figure class="highlight cpp"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br></pre></td><td class="code"><pre><code class="hljs cpp"><span class="hljs-comment">/**</span><br><span class="hljs-comment">* Copyright (C) 2015-2018 IQIYI</span><br><span class="hljs-comment">* All rights reserved.</span><br><span class="hljs-comment">*</span><br><span class="hljs-comment">* Author     : 王海斌</span><br><span class="hljs-comment">* E-mail     : wanghaibin@xx.com</span><br><span class="hljs-comment">* Version    :</span><br><span class="hljs-comment">* Date       : Thu 02 Jan 2020 09:45:24 PM CST</span><br><span class="hljs-comment">* Destription: 验证asan检测</span><br><span class="hljs-comment">*/</span><br><br><span class="hljs-meta">#<span class="hljs-meta-keyword">include</span> <span class="hljs-meta-string">&lt;stdio.h&gt;</span></span><br><span class="hljs-meta">#<span class="hljs-meta-keyword">include</span> <span class="hljs-meta-string">&lt;string.h&gt;</span></span><br><span class="hljs-meta">#<span class="hljs-meta-keyword">include</span> <span class="hljs-meta-string">&lt;iostream&gt;</span></span><br><span class="hljs-meta">#<span class="hljs-meta-keyword">include</span> <span class="hljs-meta-string">&lt;unistd.h&gt;</span></span><br><br><span class="hljs-comment">// 测试sprintf内存越界</span><br><span class="hljs-function"><span class="hljs-keyword">void</span> <span class="hljs-title">test_oom_sprintf</span><span class="hljs-params">()</span></span><br><span class="hljs-function"></span>&#123;<br>	<span class="hljs-keyword">char</span> buf[<span class="hljs-number">5</span>]=&#123;<span class="hljs-number">0</span>&#125;;<br>	<span class="hljs-keyword">const</span> <span class="hljs-keyword">char</span> * dd=<span class="hljs-string">&quot;123456&quot;</span>;<br>	<span class="hljs-built_in">sprintf</span>(buf, <span class="hljs-string">&quot;%s&quot;</span>, dd);<br>&#125;<br><br><span class="hljs-comment">//测试memcpy内存越界</span><br><span class="hljs-function"><span class="hljs-keyword">void</span> <span class="hljs-title">test_oom_memcpy</span><span class="hljs-params">()</span></span><br><span class="hljs-function"></span>&#123;<br>	<span class="hljs-keyword">char</span> buf[<span class="hljs-number">5</span>]=&#123;<span class="hljs-number">0</span>&#125;;<br>	<span class="hljs-keyword">const</span> <span class="hljs-keyword">char</span> * dd=<span class="hljs-string">&quot;123456&quot;</span>;<br>	<span class="hljs-built_in">memcpy</span>(buf, dd, <span class="hljs-built_in">strlen</span>(dd));<br>&#125;<br><br><br><span class="hljs-comment">// 测试数组访问越界</span><br><span class="hljs-function"><span class="hljs-keyword">void</span> <span class="hljs-title">test_oom_array</span><span class="hljs-params">(<span class="hljs-keyword">int</span> argc)</span></span><br><span class="hljs-function"></span>&#123;<br>	<span class="hljs-keyword">int</span> *array = <span class="hljs-keyword">new</span> <span class="hljs-keyword">int</span>[<span class="hljs-number">100</span>];<br>	array[<span class="hljs-number">0</span>] = <span class="hljs-number">0</span>;<br>	<span class="hljs-keyword">int</span> res = array[argc + <span class="hljs-number">100</span>];  <span class="hljs-comment">// BOOM</span><br>	<span class="hljs-keyword">delete</span> [] array;<br>	<span class="hljs-keyword">for</span>(;;) &#123;<br>		<span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;sss\n&quot;</span>);<br>		<span class="hljs-built_in">sleep</span>(<span class="hljs-number">1</span>);<br>	&#125;<br>&#125;<br><br><span class="hljs-function"><span class="hljs-keyword">int</span> <span class="hljs-title">main</span><span class="hljs-params">(<span class="hljs-keyword">int</span> argc, <span class="hljs-keyword">char</span> **argv)</span> </span>&#123;<br>	<span class="hljs-built_in">test_oom_sprintf</span>();<br>	<span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;<br>&#125;<br><br></code></pre></td></tr></table></figure>
</li>
<li><p>执行ldd test_oom 查看依赖库，如下图包含对libasan的引用则说明已启用<br> a. gcc 4.8或4.9编译连接库如下：</p>
 <img src="/2023/10/07/03%E8%BD%AF%E4%BB%B6%E5%BC%80%E5%8F%91/01c_cpp/16%E5%A6%82%E4%BD%95%E5%9C%A8%E7%94%9F%E4%BA%A7%E7%8E%AF%E5%A2%83%E4%B8%AD%E8%BF%BD%E8%B8%AA%E8%BF%90%E8%A1%8C%E6%80%81%E5%86%85%E5%AD%98%E5%B4%A9%E6%BA%83%E7%9A%84%E7%AC%AC%E4%B8%80%E7%8E%B0%E5%9C%BA/gcc4.8_ldd.png" srcset="/img/loading.gif" lazyload class="">

<p> gcc 5.x编译连接库如下图</p>
 <img src="/2023/10/07/03%E8%BD%AF%E4%BB%B6%E5%BC%80%E5%8F%91/01c_cpp/16%E5%A6%82%E4%BD%95%E5%9C%A8%E7%94%9F%E4%BA%A7%E7%8E%AF%E5%A2%83%E4%B8%AD%E8%BF%BD%E8%B8%AA%E8%BF%90%E8%A1%8C%E6%80%81%E5%86%85%E5%AD%98%E5%B4%A9%E6%BA%83%E7%9A%84%E7%AC%AC%E4%B8%80%E7%8E%B0%E5%9C%BA/gcc5.3_ldd.png" srcset="/img/loading.gif" lazyload class="">

<p> gcc 8.x 编译连接库如下图：</p>
 <img src="/2023/10/07/03%E8%BD%AF%E4%BB%B6%E5%BC%80%E5%8F%91/01c_cpp/16%E5%A6%82%E4%BD%95%E5%9C%A8%E7%94%9F%E4%BA%A7%E7%8E%AF%E5%A2%83%E4%B8%AD%E8%BF%BD%E8%B8%AA%E8%BF%90%E8%A1%8C%E6%80%81%E5%86%85%E5%AD%98%E5%B4%A9%E6%BA%83%E7%9A%84%E7%AC%AC%E4%B8%80%E7%8E%B0%E5%9C%BA/gcc8.3_ldd.png" srcset="/img/loading.gif" lazyload class=""></li>
<li><p>如何验证执行程序是否是否支持Address Sanitizer相关动态参数的设置<br> gcc4.x 执行help信息， 在gcc4.8下不支持相关参数，所以没有任何help相关信息，如下图</p>
 <img src="/2023/10/07/03%E8%BD%AF%E4%BB%B6%E5%BC%80%E5%8F%91/01c_cpp/16%E5%A6%82%E4%BD%95%E5%9C%A8%E7%94%9F%E4%BA%A7%E7%8E%AF%E5%A2%83%E4%B8%AD%E8%BF%BD%E8%B8%AA%E8%BF%90%E8%A1%8C%E6%80%81%E5%86%85%E5%AD%98%E5%B4%A9%E6%BA%83%E7%9A%84%E7%AC%AC%E4%B8%80%E7%8E%B0%E5%9C%BA/gcc4.8_asan_help.png" srcset="/img/loading.gif" lazyload class="">
<p> gcc 5.x编译后的支持动态参数如下图：</p>
<p> 先显示help信息，然后才输出检测的异常信息，其中help信息显示支持的动态参数信息</p>
 <figure class="highlight tcl"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br><span class="line">90</span><br><span class="line">91</span><br><span class="line">92</span><br><span class="line">93</span><br><span class="line">94</span><br><span class="line">95</span><br><span class="line">96</span><br><span class="line">97</span><br><span class="line">98</span><br><span class="line">99</span><br><span class="line">100</span><br><span class="line">101</span><br><span class="line">102</span><br><span class="line">103</span><br><span class="line">104</span><br><span class="line">105</span><br><span class="line">106</span><br><span class="line">107</span><br><span class="line">108</span><br><span class="line">109</span><br><span class="line">110</span><br><span class="line">111</span><br><span class="line">112</span><br><span class="line">113</span><br><span class="line">114</span><br><span class="line">115</span><br><span class="line">116</span><br><span class="line">117</span><br><span class="line">118</span><br><span class="line">119</span><br><span class="line">120</span><br><span class="line">121</span><br><span class="line">122</span><br><span class="line">123</span><br><span class="line">124</span><br><span class="line">125</span><br><span class="line">126</span><br><span class="line">127</span><br><span class="line">128</span><br><span class="line">129</span><br><span class="line">130</span><br><span class="line">131</span><br><span class="line">132</span><br><span class="line">133</span><br><span class="line">134</span><br><span class="line">135</span><br><span class="line">136</span><br><span class="line">137</span><br><span class="line">138</span><br><span class="line">139</span><br><span class="line">140</span><br><span class="line">141</span><br><span class="line">142</span><br><span class="line">143</span><br><span class="line">144</span><br><span class="line">145</span><br><span class="line">146</span><br><span class="line">147</span><br><span class="line">148</span><br><span class="line">149</span><br><span class="line">150</span><br><span class="line">151</span><br><span class="line">152</span><br><span class="line">153</span><br><span class="line">154</span><br><span class="line">155</span><br><span class="line">156</span><br><span class="line">157</span><br><span class="line">158</span><br><span class="line">159</span><br><span class="line">160</span><br><span class="line">161</span><br><span class="line">162</span><br><span class="line">163</span><br><span class="line">164</span><br><span class="line">165</span><br><span class="line">166</span><br><span class="line">167</span><br><span class="line">168</span><br><span class="line">169</span><br><span class="line">170</span><br><span class="line">171</span><br><span class="line">172</span><br><span class="line">173</span><br><span class="line">174</span><br><span class="line">175</span><br><span class="line">176</span><br><span class="line">177</span><br><span class="line">178</span><br><span class="line">179</span><br><span class="line">180</span><br><span class="line">181</span><br><span class="line">182</span><br><span class="line">183</span><br><span class="line">184</span><br><span class="line">185</span><br><span class="line">186</span><br><span class="line">187</span><br><span class="line">188</span><br><span class="line">189</span><br><span class="line">190</span><br><span class="line">191</span><br><span class="line">192</span><br><span class="line">193</span><br><span class="line">194</span><br><span class="line">195</span><br><span class="line">196</span><br><span class="line">197</span><br><span class="line">198</span><br><span class="line">199</span><br><span class="line">200</span><br><span class="line">201</span><br><span class="line">202</span><br><span class="line">203</span><br><span class="line">204</span><br><span class="line">205</span><br><span class="line">206</span><br><span class="line">207</span><br><span class="line">208</span><br><span class="line">209</span><br><span class="line">210</span><br><span class="line">211</span><br><span class="line">212</span><br><span class="line">213</span><br><span class="line">214</span><br><span class="line">215</span><br><span class="line">216</span><br><span class="line">217</span><br><span class="line">218</span><br><span class="line">219</span><br><span class="line">220</span><br><span class="line">221</span><br><span class="line">222</span><br><span class="line">223</span><br><span class="line">224</span><br><span class="line">225</span><br><span class="line">226</span><br><span class="line">227</span><br><span class="line">228</span><br><span class="line">229</span><br><span class="line">230</span><br><span class="line">231</span><br><span class="line">232</span><br><span class="line">233</span><br><span class="line">234</span><br><span class="line">235</span><br><span class="line">236</span><br><span class="line">237</span><br><span class="line">238</span><br><span class="line">239</span><br><span class="line">240</span><br><span class="line">241</span><br><span class="line">242</span><br><span class="line">243</span><br><span class="line">244</span><br><span class="line">245</span><br><span class="line">246</span><br><span class="line">247</span><br><span class="line">248</span><br><span class="line">249</span><br><span class="line">250</span><br><span class="line">251</span><br><span class="line">252</span><br><span class="line">253</span><br><span class="line">254</span><br><span class="line">255</span><br><span class="line">256</span><br><span class="line">257</span><br><span class="line">258</span><br><span class="line">259</span><br><span class="line">260</span><br><span class="line">261</span><br><span class="line">262</span><br><span class="line">263</span><br><span class="line">264</span><br><span class="line">265</span><br><span class="line">266</span><br><span class="line">267</span><br><span class="line">268</span><br><span class="line">269</span><br><span class="line">270</span><br><span class="line">271</span><br><span class="line">272</span><br><span class="line">273</span><br><span class="line">274</span><br><span class="line">275</span><br><span class="line">276</span><br><span class="line">277</span><br><span class="line">278</span><br><span class="line">279</span><br><span class="line">280</span><br><span class="line">281</span><br><span class="line">282</span><br><span class="line">283</span><br><span class="line">284</span><br><span class="line">285</span><br><span class="line">286</span><br><span class="line">287</span><br><span class="line">288</span><br><span class="line">289</span><br></pre></td><td class="code"><pre><code class="hljs tcl">[root@jiyang-cnc<span class="hljs-number">-10</span><span class="hljs-number">-153</span><span class="hljs-number">-56</span><span class="hljs-number">-72</span> err]# ASAN_OPTIONS=help=<span class="hljs-number">1</span> ./test_oom <br>Available flags <span class="hljs-keyword">for</span> AddressSanitizer:<br>	quarantine_size<br>		- Deprecated, please use quarantine_size_mb.<br>	quarantine_size_mb<br>		- Size (in Mb) of quarantine used to detect use-<span class="hljs-keyword">after</span>-free errors. Lower value may reduce <span class="hljs-keyword">memory</span> usage but increase the chance of false negatives.<br>	thread_local_quarantine_size_kb<br>		- Size (in Kb) of thread local quarantine used to detect use-<span class="hljs-keyword">after</span>-free errors. Lower value may reduce <span class="hljs-keyword">memory</span> usage but increase the chance of false negatives. It is not advised to go lower than <span class="hljs-number">64</span>Kb, otherwise frequent transfers to <span class="hljs-keyword">global</span> quarantine might affect performance.<br>	redzone<br>		- Minimal size (in bytes) of redzones around heap objects. Requirement: redzone &gt;= <span class="hljs-number">16</span>, is a power of two.<br>	max_redzone<br>		- Maximal size (in bytes) of redzones around heap objects.<br>	debug<br>		- If <span class="hljs-keyword">set</span>, prints some debugging information and does additional checks.<br>	report_globals<br>		- Controls the way to handle globals (<span class="hljs-number">0</span> - don&#x27;t detect buffer overflow on globals, <span class="hljs-number">1</span> - detect buffer overflow, <span class="hljs-number">2</span> - print data about registered globals).<br>	check_initialization_order<br>		- If <span class="hljs-keyword">set</span>, attempts to <span class="hljs-keyword">catch</span> initialization order issues.<br>	replace_str<br>		- If <span class="hljs-keyword">set</span>, uses custom wrappers and replacements <span class="hljs-keyword">for</span> libc <span class="hljs-keyword">string</span> functions to find more errors.<br>	replace_intrin<br>		- If <span class="hljs-keyword">set</span>, uses custom wrappers <span class="hljs-keyword">for</span> memset/memcpy/memmove intrinsics.<br>	detect_stack_use_after_return<br>		- Enables stack-use-<span class="hljs-keyword">after</span>-<span class="hljs-keyword">return</span> checking at run-<span class="hljs-keyword">time</span>.<br>	min_uar_stack_size_log<br>		- Minimum fake stack size log.<br>	max_uar_stack_size_log<br>		- Maximum fake stack size log.<br>	uar_noreserve<br>		- Use mmap with &#x27;noreserve&#x27; flag to allocate fake stack.<br>	max_malloc_fill_size<br>		- ASan allocator flag. max_malloc_fill_size is the maximal amount of bytes that will be filled with malloc_fill_byte on malloc.<br>	max_free_fill_size<br>		- ASan allocator flag. max_free_fill_size is the maximal amount of bytes that will be filled with free_fill_byte during free.<br>	malloc_fill_byte<br>		- Value used to fill the newly allocated <span class="hljs-keyword">memory</span>.<br>	free_fill_byte<br>		- Value used to fill deallocated <span class="hljs-keyword">memory</span>.<br>	allow_user_poisoning<br>		- If <span class="hljs-keyword">set</span>, user may manually mark <span class="hljs-keyword">memory</span> regions as poisoned or unpoisoned.<br>	sleep_before_dying<br>		- Number of seconds to sleep between printing an <span class="hljs-keyword">error</span> report and terminating the program. Useful <span class="hljs-keyword">for</span> debugging purposes (e.g. when one needs to attach gdb).<br>	sleep_after_init<br>		- Number of seconds to sleep <span class="hljs-keyword">after</span> AddressSanitizer is initialized. Useful <span class="hljs-keyword">for</span> debugging purposes (e.g. when one needs to attach gdb).<br>	check_malloc_usable_size<br>		- Allows the users to work around the bug in Nvidia drivers prior to <span class="hljs-number">295.</span>*.<br>	unmap_shadow_on_exit<br>		- If <span class="hljs-keyword">set</span>, explicitly unmaps the (huge) shadow at <span class="hljs-keyword">exit</span>.<br>	protect_shadow_gap<br>		- If <span class="hljs-keyword">set</span>, mprotect the shadow gap<br>	print_stats<br>		- Print various statistics <span class="hljs-keyword">after</span> printing an <span class="hljs-keyword">error</span> message or <span class="hljs-keyword">if</span> atexit=<span class="hljs-number">1.</span><br>	print_legend<br>		- Print the legend <span class="hljs-keyword">for</span> the shadow bytes.<br>	print_scariness<br>		- Print the scariness score. Experimental.<br>	atexit<br>		- If <span class="hljs-keyword">set</span>, prints ASan <span class="hljs-keyword">exit</span> stats even <span class="hljs-keyword">after</span> program terminates successfully.<br>	print_full_thread_history<br>		- If <span class="hljs-keyword">set</span>, prints thread creation stacks <span class="hljs-keyword">for</span> the threads involved in the report and their ancestors up to the main thread.<br>	poison_heap<br>		- Poison (or not) the heap <span class="hljs-keyword">memory</span> on [de]allocation. Zero value is useful <span class="hljs-keyword">for</span> benchmarking the allocator or instrumentator.<br>	poison_partial<br>		- If true, poison partially addressable <span class="hljs-number">8</span>-byte aligned words (default=true). This flag affects heap and <span class="hljs-keyword">global</span> buffers, but not stack buffers.<br>	poison_array_cookie<br>		- Poison (or not) the <span class="hljs-keyword">array</span> cookie <span class="hljs-keyword">after</span> operator new[].<br>	alloc_dealloc_mismatch<br>		- Report errors on malloc/delete, new/free, new/delete[], etc.<br>	new_delete_type_mismatch<br>		- Report errors on mismatch between size of new and delete.<br>	strict_init_order<br>		- If true, assume that dynamic initializers can never access globals from other modules, even <span class="hljs-keyword">if</span> the latter are already initialized.<br>	start_deactivated<br>		- If true, ASan tweaks a bunch of other flags (quarantine, redzone, heap poisoning) to reduce <span class="hljs-keyword">memory</span> consumption as much as possible, and restores them to original values when the first instrumented module is loaded into the process. This is mainly intended to be used on Android. <br>	detect_invalid_pointer_pairs<br>		- If &gt;= <span class="hljs-number">2</span>, detect operations like &lt;, &lt;=, &gt;, &gt;= and - on invalid pointer pairs (e.g. when pointers belong to different objects); If == <span class="hljs-number">1</span>, detect invalid operations only when both pointers are non-null.<br>	detect_container_overflow<br>		- If true, honor the container overflow annotations. See https://github.com/google/sanitizers/wiki/AddressSanitizerContainerOverflow<br>	detect_odr_violation<br>		- If &gt;=<span class="hljs-number">2</span>, detect violation of One-Definition-Rule (ODR); If ==<span class="hljs-number">1</span>, detect ODR-violation only <span class="hljs-keyword">if</span> the two variables have different sizes<br>	suppressions<br>		- Suppressions <span class="hljs-keyword">file</span> name.<br>	halt_on_error<br>		- Crash the program <span class="hljs-keyword">after</span> printing the first <span class="hljs-keyword">error</span> report (WARNING: USE AT YOUR OWN RISK!)<br>	use_odr_indicator<br>		- Use special ODR indicator symbol <span class="hljs-keyword">for</span> ODR violation detection<br>	allocator_frees_and_returns_null_on_realloc_zero<br>		- realloc(p, <span class="hljs-number">0</span>) is equivalent to free(p) by default (Same as the POSIX standard). If <span class="hljs-keyword">set</span> to false, realloc(p, <span class="hljs-number">0</span>) will <span class="hljs-keyword">return</span> a pointer to an allocated space which can not be used.<br>	verify_asan_link_order<br>		- Check position of ASan runtime in library <span class="hljs-keyword">list</span> (needs to be disabled when other library has to be preloaded system-wide)<br>	symbolize<br>		- If <span class="hljs-keyword">set</span>, use the online symbolizer from common sanitizer runtime to turn virtual addresses to <span class="hljs-keyword">file</span>/line locations.<br>	external_symbolizer_path<br>		- Path to external symbolizer. If empty, the tool will search <span class="hljs-variable">$PATH</span> <span class="hljs-keyword">for</span> the symbolizer.<br>	allow_addr2line<br>		- If <span class="hljs-keyword">set</span>, allows online symbolizer to run addr2line <span class="hljs-keyword">binary</span> to symbolize stack traces (addr2line will only be used <span class="hljs-keyword">if</span> llvm-symbolizer <span class="hljs-keyword">binary</span> is unavailable.<br>	strip_path_prefix<br>		- Strips this prefix from <span class="hljs-keyword">file</span> paths in <span class="hljs-keyword">error</span> reports.<br>	fast_unwind_on_check<br>		- If available, use the fast frame-pointer-based unwinder on internal CHECK failures.<br>	fast_unwind_on_fatal<br>		- If available, use the fast frame-pointer-based unwinder on fatal errors.<br>	fast_unwind_on_malloc<br>		- If available, use the fast frame-pointer-based unwinder on malloc/free.<br>	handle_ioctl<br>		- Intercept and handle ioctl requests.<br>	malloc_context_size<br>		- Max number of stack frames kept <span class="hljs-keyword">for</span> each allocation/deallocation.<br>	log_path<br>		- Write logs to <span class="hljs-string">&quot;log_path.pid&quot;</span>. The special values are <span class="hljs-string">&quot;stdout&quot;</span> and <span class="hljs-string">&quot;stderr&quot;</span>. The default is <span class="hljs-string">&quot;stderr&quot;</span>.<br>	log_exe_name<br>		- Mention name of executable when reporting <span class="hljs-keyword">error</span> and <span class="hljs-keyword">append</span> executable name to logs (as in <span class="hljs-string">&quot;log_path.exe_name.pid&quot;</span>).<br>	log_to_syslog<br>		- Write all sanitizer output to syslog in addition to other means of logging.<br>	verbosity<br>		- Verbosity level (<span class="hljs-number">0</span> - silent, <span class="hljs-number">1</span> - a bit of output, <span class="hljs-number">2</span>+ - more output).<br>	detect_leaks<br>		- Enable <span class="hljs-keyword">memory</span> leak detection.<br>	leak_check_at_exit<br>		- Invoke leak checking in an atexit handler. Has no effect <span class="hljs-keyword">if</span> detect_leaks=false, or <span class="hljs-keyword">if</span> __lsan_do_leak_check() is called before the handler has a chance to run.<br>	allocator_may_return_null<br>		- If false, the allocator will crash instead of returning <span class="hljs-number">0</span> on out-of-<span class="hljs-keyword">memory</span>.<br>	print_summary<br>		- If false, disable printing <span class="hljs-keyword">error</span> summaries in addition to <span class="hljs-keyword">error</span> reports.<br>	print_module_map<br>		- OS X only (<span class="hljs-number">0</span> - don&#x27;t print, <span class="hljs-number">1</span> - print only once before process exits, <span class="hljs-number">2</span> - print <span class="hljs-keyword">after</span> each report).<br>	check_printf<br>		- Check printf arguments.<br>	handle_segv<br>		- Controls custom tool&#x27;s SIGSEGV handler (<span class="hljs-number">0</span> - do not registers the handler, <span class="hljs-number">1</span> - register the handler and allow user to <span class="hljs-keyword">set</span> own, <span class="hljs-number">2</span> - registers the handler and block user from changing it). <br>	handle_sigbus<br>		- Controls custom tool&#x27;s SIGBUS handler (<span class="hljs-number">0</span> - do not registers the handler, <span class="hljs-number">1</span> - register the handler and allow user to <span class="hljs-keyword">set</span> own, <span class="hljs-number">2</span> - registers the handler and block user from changing it). <br>	handle_abort<br>		- Controls custom tool&#x27;s SIGABRT handler (<span class="hljs-number">0</span> - do not registers the handler, <span class="hljs-number">1</span> - register the handler and allow user to <span class="hljs-keyword">set</span> own, <span class="hljs-number">2</span> - registers the handler and block user from changing it). <br>	handle_sigill<br>		- Controls custom tool&#x27;s SIGILL handler (<span class="hljs-number">0</span> - do not registers the handler, <span class="hljs-number">1</span> - register the handler and allow user to <span class="hljs-keyword">set</span> own, <span class="hljs-number">2</span> - registers the handler and block user from changing it). <br>	handle_sigfpe<br>		- Controls custom tool&#x27;s SIGFPE handler (<span class="hljs-number">0</span> - do not registers the handler, <span class="hljs-number">1</span> - register the handler and allow user to <span class="hljs-keyword">set</span> own, <span class="hljs-number">2</span> - registers the handler and block user from changing it). <br>	allow_user_segv_handler<br>		- Deprecated. True has no effect, use handle_sigbus=<span class="hljs-number">1.</span> If false, handle_*=<span class="hljs-number">1</span> will be upgraded to handle_*=<span class="hljs-number">2.</span><br>	use_sigaltstack<br>		- If <span class="hljs-keyword">set</span>, uses alternate stack <span class="hljs-keyword">for</span> signal handling.<br>	detect_deadlocks<br>		- If <span class="hljs-keyword">set</span>, deadlock detection is enabled.<br>	clear_shadow_mmap_threshold<br>		- Large shadow regions are zero-filled using mmap(NORESERVE) instead of memset(). This is the threshold size in bytes.<br>	color<br>		- Colorize reports: (always|never|auto).<br>	legacy_pthread_cond<br>		- Enables support <span class="hljs-keyword">for</span> dynamic libraries linked with libpthread <span class="hljs-number">2.2</span><span class="hljs-number">.5</span>.<br>	intercept_tls_get_addr<br>		- Intercept __tls_get_addr.<br>	help<br>		- Print the flag descriptions.<br>	mmap_limit_mb<br>		- Limit the amount of mmap-ed <span class="hljs-keyword">memory</span> (excluding shadow) in Mb; not a user-facing flag, used mosly <span class="hljs-keyword">for</span> testing the tools<br>	hard_rss_limit_mb<br>		- Hard RSS limit in Mb. If non-zero, a background thread is spawned at startup which periodically reads RSS and aborts the process <span class="hljs-keyword">if</span> the limit is reached<br>	soft_rss_limit_mb<br>		- Soft RSS limit in Mb. If non-zero, a background thread is spawned at startup which periodically reads RSS. If the limit is reached all subsequent malloc/new calls will fail or <span class="hljs-keyword">return</span> NULL (depending on the value of allocator_may_return_null) until the RSS goes below the soft limit. This limit does not affect <span class="hljs-keyword">memory</span> allocations other than malloc/new.<br>	heap_profile<br>		- Experimental heap profiler, asan-only<br>	allocator_release_to_os_interval_ms<br>		- Experimental. Only affects a <span class="hljs-number">64</span>-bit allocator. If <span class="hljs-keyword">set</span>, tries to release unused <span class="hljs-keyword">memory</span> to the OS, but not more often than this interval (in milliseconds). Negative values mean do not attempt to release <span class="hljs-keyword">memory</span> to the OS.<br><br>	can_use_proc_maps_statm<br>		- If false, do not attempt to <span class="hljs-keyword">read</span> /<span class="hljs-keyword">proc</span>/maps/statm.<span class="hljs-title"> Mostly</span> useful<span class="hljs-title"> for</span> testing<span class="hljs-title"> sanitizers.</span><br><span class="hljs-title">	coverage</span><br>		-<span class="hljs-title"> If</span> set,<span class="hljs-title"> coverage</span> information<span class="hljs-title"> will</span> be<span class="hljs-title"> dumped</span> at<span class="hljs-title"> program</span> shutdown (if<span class="hljs-title"> the</span> coverage<span class="hljs-title"> instrumentation</span> was<span class="hljs-title"> enabled</span> at<span class="hljs-title"> compile</span> time).<span class="hljs-title"></span><br><span class="hljs-title">	coverage_dir</span><br>		-<span class="hljs-title"> Target</span> directory<span class="hljs-title"> for</span> coverage<span class="hljs-title"> dumps.</span> Defaults<span class="hljs-title"> to</span> the<span class="hljs-title"> current</span> directory.<span class="hljs-title"></span><br><span class="hljs-title">	full_address_space</span><br>		-<span class="hljs-title"> Sanitize</span> complete<span class="hljs-title"> address</span> space;<span class="hljs-title"> by</span> default<span class="hljs-title"> kernel</span> area<span class="hljs-title"> on</span> 32-bit<span class="hljs-title"> platforms</span> will<span class="hljs-title"> not</span> be<span class="hljs-title"> sanitized</span><br><span class="hljs-title">	print_suppressions</span><br>		-<span class="hljs-title"> Print</span> matched<span class="hljs-title"> suppressions</span> at<span class="hljs-title"> exit.</span><br><span class="hljs-title">	disable_coredump</span><br>		-<span class="hljs-title"> Disable</span> core<span class="hljs-title"> dumping.</span> By<span class="hljs-title"> default,</span> disable_coredump=1<span class="hljs-title"> on</span> 64-bit<span class="hljs-title"> to</span> avoid<span class="hljs-title"> dumping</span> a 16T+<span class="hljs-title"> core</span> file.<span class="hljs-title"> Ignored</span> on<span class="hljs-title"> OSes</span> that<span class="hljs-title"> don&#x27;t</span> dump<span class="hljs-title"> core</span> by<span class="hljs-title"> default</span> and<span class="hljs-title"> for</span> sanitizers<span class="hljs-title"> that</span> don&#x27;t<span class="hljs-title"> reserve</span> lots<span class="hljs-title"> of</span> virtual<span class="hljs-title"> memory.</span><br><span class="hljs-title">	use_madv_dontdump</span><br>		-<span class="hljs-title"> If</span> set,<span class="hljs-title"> instructs</span> kernel<span class="hljs-title"> to</span> not<span class="hljs-title"> store</span> the (huge)<span class="hljs-title"> shadow</span> in<span class="hljs-title"> core</span> file.<span class="hljs-title"></span><br><span class="hljs-title">	symbolize_inline_frames</span><br>		-<span class="hljs-title"> Print</span> inlined<span class="hljs-title"> frames</span> in<span class="hljs-title"> stacktraces.</span> Defaults<span class="hljs-title"> to</span> true.<span class="hljs-title"></span><br><span class="hljs-title">	symbolize_vs_style</span><br>		-<span class="hljs-title"> Print</span> file<span class="hljs-title"> locations</span> in<span class="hljs-title"> Visual</span> Studio<span class="hljs-title"> style</span> (e.g:<span class="hljs-title">  file(10,42):</span> ...<span class="hljs-title"></span><br><span class="hljs-title">	dedup_token_length</span><br>		-<span class="hljs-title"> If</span> positive,<span class="hljs-title"> after</span> printing<span class="hljs-title"> a</span> stack<span class="hljs-title"> trace</span> also<span class="hljs-title"> print</span> a<span class="hljs-title"> short</span> string<span class="hljs-title"> token</span> based<span class="hljs-title"> on</span> this<span class="hljs-title"> number</span> of<span class="hljs-title"> frames</span> that<span class="hljs-title"> will</span> simplify<span class="hljs-title"> deduplication</span> of<span class="hljs-title"> the</span> reports.<span class="hljs-title"> Example:</span> &#x27;DEDUP_TOKEN:<span class="hljs-title"> foo-bar-main&#x27;.</span> Default<span class="hljs-title"> is</span> 0.<span class="hljs-title"></span><br><span class="hljs-title">	stack_trace_format</span><br>		-<span class="hljs-title"> Format</span> string<span class="hljs-title"> used</span> to<span class="hljs-title"> render</span> stack<span class="hljs-title"> frames.</span> See<span class="hljs-title"> sanitizer_stacktrace_printer.h</span> for<span class="hljs-title"> the</span> format<span class="hljs-title"> description.</span> Use<span class="hljs-title"> DEFAULT</span> to<span class="hljs-title"> get</span> default<span class="hljs-title"> format.</span><br><span class="hljs-title">	no_huge_pages_for_shadow</span><br>		-<span class="hljs-title"> If</span> true,<span class="hljs-title"> the</span> shadow<span class="hljs-title"> is</span> not<span class="hljs-title"> allowed</span> to<span class="hljs-title"> use</span> huge<span class="hljs-title"> pages.</span> <span class="hljs-title"></span><br><span class="hljs-title">	strict_string_checks</span><br>		-<span class="hljs-title"> If</span> set<span class="hljs-title"> check</span> that<span class="hljs-title"> string</span> arguments<span class="hljs-title"> are</span> properly<span class="hljs-title"> null-terminated</span><br><span class="hljs-title">	intercept_strstr</span><br>		-<span class="hljs-title"> If</span> set,<span class="hljs-title"> uses</span> custom<span class="hljs-title"> wrappers</span> for<span class="hljs-title"> strstr</span> and<span class="hljs-title"> strcasestr</span> functions<span class="hljs-title"> to</span> find<span class="hljs-title"> more</span> errors.<span class="hljs-title"></span><br><span class="hljs-title">	intercept_strspn</span><br>		-<span class="hljs-title"> If</span> set,<span class="hljs-title"> uses</span> custom<span class="hljs-title"> wrappers</span> for<span class="hljs-title"> strspn</span> and<span class="hljs-title"> strcspn</span> function<span class="hljs-title"> to</span> find<span class="hljs-title"> more</span> errors.<span class="hljs-title"></span><br><span class="hljs-title">	intercept_strtok</span><br>		-<span class="hljs-title"> If</span> set,<span class="hljs-title"> uses</span> a<span class="hljs-title"> custom</span> wrapper<span class="hljs-title"> for</span> the<span class="hljs-title"> strtok</span> function<span class="hljs-title"> to</span> find<span class="hljs-title"> more</span> errors.<span class="hljs-title"></span><br><span class="hljs-title">	intercept_strpbrk</span><br>		-<span class="hljs-title"> If</span> set,<span class="hljs-title"> uses</span> custom<span class="hljs-title"> wrappers</span> for<span class="hljs-title"> strpbrk</span> function<span class="hljs-title"> to</span> find<span class="hljs-title"> more</span> errors.<span class="hljs-title"></span><br><span class="hljs-title">	intercept_strlen</span><br>		-<span class="hljs-title"> If</span> set,<span class="hljs-title"> uses</span> custom<span class="hljs-title"> wrappers</span> for<span class="hljs-title"> strlen</span> and<span class="hljs-title"> strnlen</span> functions<span class="hljs-title"> to</span> find<span class="hljs-title"> more</span> errors.<span class="hljs-title"></span><br><span class="hljs-title">	intercept_strndup</span><br>		-<span class="hljs-title"> If</span> set,<span class="hljs-title"> uses</span> custom<span class="hljs-title"> wrappers</span> for<span class="hljs-title"> strndup</span> functions<span class="hljs-title"> to</span> find<span class="hljs-title"> more</span> errors.<span class="hljs-title"></span><br><span class="hljs-title">	intercept_strchr</span><br>		-<span class="hljs-title"> If</span> set,<span class="hljs-title"> uses</span> custom<span class="hljs-title"> wrappers</span> for<span class="hljs-title"> strchr,</span> strchrnul,<span class="hljs-title"> and</span> strrchr<span class="hljs-title"> functions</span> to<span class="hljs-title"> find</span> more<span class="hljs-title"> errors.</span><br><span class="hljs-title">	intercept_memcmp</span><br>		-<span class="hljs-title"> If</span> set,<span class="hljs-title"> uses</span> custom<span class="hljs-title"> wrappers</span> for<span class="hljs-title"> memcmp</span> function<span class="hljs-title"> to</span> find<span class="hljs-title"> more</span> errors.<span class="hljs-title"></span><br><span class="hljs-title">	strict_memcmp</span><br>		-<span class="hljs-title"> If</span> true,<span class="hljs-title"> assume</span> that<span class="hljs-title"> memcmp(p1,</span> p2,<span class="hljs-title"> n)</span> always<span class="hljs-title"> reads</span> n<span class="hljs-title"> bytes</span> before<span class="hljs-title"> comparing</span> p1<span class="hljs-title"> and</span> p2.<span class="hljs-title"></span><br><span class="hljs-title">	intercept_memmem</span><br>		-<span class="hljs-title"> If</span> set,<span class="hljs-title"> uses</span> a<span class="hljs-title"> wrapper</span> for<span class="hljs-title"> memmem()</span> to<span class="hljs-title"> find</span> more<span class="hljs-title"> errors.</span><br><span class="hljs-title">	intercept_intrin</span><br>		-<span class="hljs-title"> If</span> set,<span class="hljs-title"> uses</span> custom<span class="hljs-title"> wrappers</span> for<span class="hljs-title"> memset/memcpy/memmove</span> intrinsics<span class="hljs-title"> to</span> find<span class="hljs-title"> more</span> errors.<span class="hljs-title"></span><br><span class="hljs-title">	intercept_stat</span><br>		-<span class="hljs-title"> If</span> set,<span class="hljs-title"> uses</span> custom<span class="hljs-title"> wrappers</span> for *stat<span class="hljs-title"> functions</span> to<span class="hljs-title"> find</span> more<span class="hljs-title"> errors.</span><br><span class="hljs-title">	intercept_send</span><br>		-<span class="hljs-title"> If</span> set,<span class="hljs-title"> uses</span> custom<span class="hljs-title"> wrappers</span> for<span class="hljs-title"> send*</span> functions<span class="hljs-title"> to</span> find<span class="hljs-title"> more</span> errors.<span class="hljs-title"></span><br><span class="hljs-title">	decorate_proc_maps</span><br>		-<span class="hljs-title"> If</span> set,<span class="hljs-title"> decorate</span> sanitizer<span class="hljs-title"> mappings</span> in /<span class="hljs-keyword">proc</span>/self/maps<span class="hljs-title"> with</span> user-readable<span class="hljs-title"> names</span><br><span class="hljs-title">	exitcode</span><br>		-<span class="hljs-title"> Override</span> the<span class="hljs-title"> program</span> exit<span class="hljs-title"> status</span> if<span class="hljs-title"> the</span> tool<span class="hljs-title"> found</span> an<span class="hljs-title"> error</span><br><span class="hljs-title">	abort_on_error</span><br>		-<span class="hljs-title"> If</span> set,<span class="hljs-title"> the</span> tool<span class="hljs-title"> calls</span> abort()<span class="hljs-title"> instead</span> of<span class="hljs-title"> _exit()</span> after<span class="hljs-title"> printing</span> the<span class="hljs-title"> error</span> report.<span class="hljs-title"></span><br><span class="hljs-title">	suppress_equal_pcs</span><br>		-<span class="hljs-title"> Deduplicate</span> multiple<span class="hljs-title"> reports</span> for<span class="hljs-title"> single</span> source<span class="hljs-title"> location</span> in<span class="hljs-title"> halt_on_error=false</span> mode (asan<span class="hljs-title"> only).</span><br><span class="hljs-title">	print_cmdline</span><br>		-<span class="hljs-title"> Print</span> command<span class="hljs-title"> line</span> on<span class="hljs-title"> crash</span> (asan<span class="hljs-title"> only).</span><br><span class="hljs-title">	html_cov_report</span><br>		-<span class="hljs-title"> Generate</span> html<span class="hljs-title"> coverage</span> report.<span class="hljs-title"></span><br><span class="hljs-title">	sancov_path</span><br>		-<span class="hljs-title"> Sancov</span> tool<span class="hljs-title"> location.</span><br><span class="hljs-title">	dump_instruction_bytes</span><br>		-<span class="hljs-title"> If</span> true,<span class="hljs-title"> dump</span> 16<span class="hljs-title"> bytes</span> starting<span class="hljs-title"> at</span> the<span class="hljs-title"> instruction</span> that<span class="hljs-title"> caused</span> SEGV<span class="hljs-title"></span><br><span class="hljs-title">	dump_registers</span><br>		-<span class="hljs-title"> If</span> true,<span class="hljs-title"> dump</span> values<span class="hljs-title"> of</span> CPU<span class="hljs-title"> registers</span> when<span class="hljs-title"> SEGV</span> happens.<span class="hljs-title"> Only</span> available<span class="hljs-title"> on</span> OS<span class="hljs-title"> X</span> for<span class="hljs-title"> now.</span><br><span class="hljs-title">	include</span><br>		-<span class="hljs-title"> read</span> more<span class="hljs-title"> options</span> from<span class="hljs-title"> the</span> given<span class="hljs-title"> file</span><br><span class="hljs-title">	include_if_exists</span><br>		-<span class="hljs-title"> read</span> more<span class="hljs-title"> options</span> from<span class="hljs-title"> the</span> given<span class="hljs-title"> file</span> (if<span class="hljs-title"> it</span> exists)<br>=================================================================<br>==4911==ERROR:<span class="hljs-title"> AddressSanitizer:</span> stack-buffer-overflow<span class="hljs-title"> on</span> address 0x7ffe84af3135<span class="hljs-title"> at</span> pc 0x2ab12ca03533<span class="hljs-title"> bp</span> 0x7ffe84af3000<span class="hljs-title"> sp</span> 0x7ffe84af2790<span class="hljs-title"></span><br><span class="hljs-title">WRITE</span> of<span class="hljs-title"> size</span> 7<span class="hljs-title"> at</span> 0x7ffe84af3135<span class="hljs-title"> thread</span> T0<br>	#0 0x2ab12ca03532<span class="hljs-title"> in</span> __interceptor_vsprintf (/usr/lib64/libasan.so.5+0x55532)<br>	#1 0x2ab12ca038a6<span class="hljs-title"> in</span> sprintf (/usr/lib64/libasan.so.5+0x558a6)<br>	#2 0x400de1<span class="hljs-title"> in</span> test_oom_sprintf() /root/err/main2.cpp:22<br>	#3 0x40108d<span class="hljs-title"> in</span> main /root/err/main2.cpp:48<br>	#4 0x2ab12e1bdb34<span class="hljs-title"> in</span> __libc_start_main (/usr/lib64/libc.so.6+0x21b34)<br>	#5 0x400c28  (/root/err/test_oom+0x400c28)<span class="hljs-title"></span><br><span class="hljs-title"></span><br><span class="hljs-title">Address</span> 0x7ffe84af3135<span class="hljs-title"> is</span> located<span class="hljs-title"> in</span> stack<span class="hljs-title"> of</span> thread<span class="hljs-title"> T0</span> at<span class="hljs-title"> offset</span> 37<span class="hljs-title"> in</span> frame<br>	#0 0x400ce1<span class="hljs-title"> in</span> test_oom_sprintf() /root/err/main2.cpp:19<span class="hljs-title"></span><br><span class="hljs-title"></span><br><span class="hljs-title">This</span> frame<span class="hljs-title"> has</span> 1<span class="hljs-title"> object(s):</span><br>	[32, 37) &#x27;buf&#x27; &lt;==<span class="hljs-title"> Memory</span> access<span class="hljs-title"> at</span> offset 37<span class="hljs-title"> overflows</span> this<span class="hljs-title"> variable</span><br>HINT:<span class="hljs-title"> this</span> may<span class="hljs-title"> be</span> a<span class="hljs-title"> false</span> positive<span class="hljs-title"> if</span> your<span class="hljs-title"> program</span> uses<span class="hljs-title"> some</span> custom<span class="hljs-title"> stack</span> unwind<span class="hljs-title"> mechanism</span> or<span class="hljs-title"> swapcontext</span><br>	(longjmp<span class="hljs-title"> and</span> C++<span class="hljs-title"> exceptions</span> *are*<span class="hljs-title"> supported)</span><br>SUMMARY:<span class="hljs-title"> AddressSanitizer:</span> stack-buffer-overflow (/usr/lib64/libasan.so.5+0x55532)<span class="hljs-title"> in</span> __interceptor_vsprintf<span class="hljs-title"></span><br><span class="hljs-title">Shadow</span> bytes<span class="hljs-title"> around</span> the<span class="hljs-title"> buggy</span> address:<br>0x1000509565d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br>0x1000509565e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br>0x1000509565f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br>0x100050956600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br>0x100050956610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br>=&gt;0x100050956620: 00 00<span class="hljs-title"> f1</span> f1<span class="hljs-title"> f1</span> f1[05]f2<span class="hljs-title"> f2</span> f2<span class="hljs-title"> f3</span> f3<span class="hljs-title"> f3</span> f3 00 00<br>0x100050956630: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br>0x100050956640: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br>0x100050956650: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br>0x100050956660: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br>0x100050956670: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<span class="hljs-title"></span><br><span class="hljs-title">Shadow</span> byte<span class="hljs-title"> legend</span> (one<span class="hljs-title"> shadow</span> byte<span class="hljs-title"> represents</span> 8<span class="hljs-title"> application</span> bytes):<span class="hljs-title"></span><br><span class="hljs-title">Addressable:</span>           00<span class="hljs-title"></span><br><span class="hljs-title">Partially</span> addressable: 01 02 03 04 05 06 07<span class="hljs-title"> </span><br><span class="hljs-title">Heap</span> left<span class="hljs-title"> redzone:</span> <span class="hljs-title">      fa</span><br>Freed<span class="hljs-title"> heap</span> region:<span class="hljs-title">       fd</span><br>Stack<span class="hljs-title"> left</span> redzone:<span class="hljs-title">      f1</span><br>Stack<span class="hljs-title"> mid</span> redzone:<span class="hljs-title">       f2</span><br>Stack<span class="hljs-title"> right</span> redzone:<span class="hljs-title">     f3</span><br>Stack<span class="hljs-title"> after</span> return:<span class="hljs-title">      f5</span><br>Stack<span class="hljs-title"> use</span> after<span class="hljs-title"> scope:</span> <span class="hljs-title">  f8</span><br>Global<span class="hljs-title"> redzone:</span> <span class="hljs-title">         f9</span><br>Global<span class="hljs-title"> init</span> order:<span class="hljs-title">       f6</span><br>Poisoned<span class="hljs-title"> by</span> user:<span class="hljs-title">        f7</span><br>Container<span class="hljs-title"> overflow:</span> <span class="hljs-title">     fc</span><br>Array<span class="hljs-title"> cookie:</span> <span class="hljs-title">           ac</span><br>Intra<span class="hljs-title"> object</span> redzone:<span class="hljs-title">    bb</span><br>ASan<span class="hljs-title"> internal:</span> <span class="hljs-title">          fe</span><br>Left<span class="hljs-title"> alloca</span> redzone:<span class="hljs-title">     ca</span><br>Right<span class="hljs-title"> alloca</span> redzone:<span class="hljs-title">    cb</span><br>==4911==ABORTING<br></code></pre></td></tr></table></figure></li>
</ol>
<h2 id="遇到的问题和解决方法"><a href="#遇到的问题和解决方法" class="headerlink" title="遇到的问题和解决方法"></a>遇到的问题和解决方法</h2><ul>
<li>找不到 libasan_preinit.o<br>  安装和gcc版本匹配的libasan-devel库即可</li>
<li>错误信息只能输出到屏幕，不能输出到日志<br>  一般是gcc版本&lt;5.x导致，升级gcc和对应的libasan库即可</li>
<li>升级到高版gcc后，程序执行后仍然不能输出错误信息到到日志文件中，或者设置的ASAN_OPTIONS参数根本没效果<br>  确保编译时添加了-fsanitize=address等编译参数后，仍无法输出，可以考虑在程序中添加环境变量信息输出验证是否设置了ASAN_OPTIONS</li>
<li>是否可以在程序main函数入口处调用setenv函数来设置ASAN_OPTIONS来达到启用asan动态参数的目的<br>  经验证不可以,程序在执行main函数前libasan已经检测ASAN_OPTIONS参数，所以要在程序启动时传递或已经设置系统环境变量</li>
<li>当前开发机gcc为4.x版本，怎么样可以快速的切换gcc到高版本且不破坏当前的开发环境<br>  安装SCL，通过SCL安装各个不同版本的gcc，且可以快速方便的切换不同版本, scl enable devtoolset-4 bash</li>
</ul>
<h1 id="使用SCL-快速构建不同gcc-g-版本开发环境"><a href="#使用SCL-快速构建不同gcc-g-版本开发环境" class="headerlink" title="使用SCL 快速构建不同gcc/g++版本开发环境"></a>使用SCL 快速构建不同gcc/g++版本开发环境</h1><h2 id="介绍-1"><a href="#介绍-1" class="headerlink" title="介绍"></a>介绍</h2><p>SCL(Software Collections)可以让您能够在同一系统上构建，安装和使用多个版本的软件，而不会影响整个系统已安装的软件包。</p>
<p>devtoolset 就是按照 Software Collections 的规范打出来的一套 rpm 包。通过scl可以方便的切换不同版本的devtoolset开发环境。个人认为可以理解为类似docker的开发环境，只是更轻量，更方便。</p>
<p>SCL项目主页：<a target="_blank" rel="noopener" href="https://www.softwarecollections.org/">https://www.softwarecollections.org/</a></p>
<h2 id="安装及使用"><a href="#安装及使用" class="headerlink" title="安装及使用"></a>安装及使用</h2><h3 id="安装scl源"><a href="#安装scl源" class="headerlink" title="安装scl源"></a>安装scl源</h3><figure class="highlight mipsasm"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs mipsasm">yum <span class="hljs-keyword">install </span>centos-release-<span class="hljs-keyword">scl </span><span class="hljs-keyword">scl-utils-build</span><br></code></pre></td></tr></table></figure>

<h3 id="列出scl源有哪些包可以用："><a href="#列出scl源有哪些包可以用：" class="headerlink" title="列出scl源有哪些包可以用："></a>列出scl源有哪些包可以用：</h3><figure class="highlight ada"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs ada">yum list <span class="hljs-keyword">all</span> <span class="hljs-comment">--enablerepo=&#x27;centos-sclo-rh&#x27;</span><br></code></pre></td></tr></table></figure>

<h3 id="安装对应版本的devtoolset开发包"><a href="#安装对应版本的devtoolset开发包" class="headerlink" title="安装对应版本的devtoolset开发包"></a>安装对应版本的devtoolset开发包</h3><p>如：安装8.3版本的gcc、gcc-c++等开发环境需要的包执行如下安装命令</p>
<figure class="highlight apache"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs apache"><span class="hljs-attribute">yum</span> install -y devtoolset-<span class="hljs-number">8</span>-gcc-gdb-plugin-<span class="hljs-number">8</span>.<span class="hljs-number">3</span>.<span class="hljs-number">1</span>-<span class="hljs-number">3</span>.<span class="hljs-number">1</span>.el<span class="hljs-number">7</span>.x<span class="hljs-number">86</span>_<span class="hljs-number">64</span> devtoolset-<span class="hljs-number">8</span>-libstdc++-devel-<span class="hljs-number">8</span>.<span class="hljs-number">3</span>.<span class="hljs-number">1</span>-<span class="hljs-number">3</span>.<span class="hljs-number">1</span>.el<span class="hljs-number">7</span>.x<span class="hljs-number">86</span>_<span class="hljs-number">64</span> devtoolset-<span class="hljs-number">8</span>-binutils-<span class="hljs-number">2</span>.<span class="hljs-number">30</span>-<span class="hljs-number">54</span>.el<span class="hljs-number">7</span>.x<span class="hljs-number">86</span>_<span class="hljs-number">64</span> devtoolset-<span class="hljs-number">8</span>-gcc-<span class="hljs-number">8</span>.<span class="hljs-number">3</span>.<span class="hljs-number">1</span>-<span class="hljs-number">3</span>.<span class="hljs-number">1</span>.el<span class="hljs-number">7</span>.x<span class="hljs-number">86</span>_<span class="hljs-number">64</span> devtoolset-<span class="hljs-number">8</span>-libasan-devel-<span class="hljs-number">8</span>.<span class="hljs-number">3</span>.<span class="hljs-number">1</span>-<span class="hljs-number">3</span>.<span class="hljs-number">1</span>.el<span class="hljs-number">7</span>.x<span class="hljs-number">86</span>_<span class="hljs-number">64</span> devtoolset-<span class="hljs-number">8</span>-gcc-c++-<span class="hljs-number">8</span>.<span class="hljs-number">3</span>.<span class="hljs-number">1</span>-<span class="hljs-number">3</span>.<span class="hljs-number">1</span>.el<span class="hljs-number">7</span>.x<span class="hljs-number">86</span>_<span class="hljs-number">64</span> devtoolset-<span class="hljs-number">8</span>-runtime-<span class="hljs-number">8</span>.<span class="hljs-number">1</span>-<span class="hljs-number">1</span>.el<span class="hljs-number">7</span>.x<span class="hljs-number">86</span>_<span class="hljs-number">64</span><br></code></pre></td></tr></table></figure>

<h3 id="查看安装的devtoolset环境列表"><a href="#查看安装的devtoolset环境列表" class="headerlink" title="查看安装的devtoolset环境列表"></a>查看安装的devtoolset环境列表</h3><figure class="highlight ebnf"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs ebnf"><span class="hljs-attribute">scl -l</span><br></code></pre></td></tr></table></figure>
<img src="/2023/10/07/03%E8%BD%AF%E4%BB%B6%E5%BC%80%E5%8F%91/01c_cpp/16%E5%A6%82%E4%BD%95%E5%9C%A8%E7%94%9F%E4%BA%A7%E7%8E%AF%E5%A2%83%E4%B8%AD%E8%BF%BD%E8%B8%AA%E8%BF%90%E8%A1%8C%E6%80%81%E5%86%85%E5%AD%98%E5%B4%A9%E6%BA%83%E7%9A%84%E7%AC%AC%E4%B8%80%E7%8E%B0%E5%9C%BA/image2020-1-3_13-53-13.png" srcset="/img/loading.gif" lazyload class="">

<h3 id="切换到devtoolset-8环境"><a href="#切换到devtoolset-8环境" class="headerlink" title="切换到devtoolset-8环境"></a>切换到devtoolset-8环境</h3><figure class="highlight routeros"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs routeros">scl <span class="hljs-builtin-name">enable</span> devtoolset-8 bash<br></code></pre></td></tr></table></figure>
<p>切换后效果如下：</p>
<img src="/2023/10/07/03%E8%BD%AF%E4%BB%B6%E5%BC%80%E5%8F%91/01c_cpp/16%E5%A6%82%E4%BD%95%E5%9C%A8%E7%94%9F%E4%BA%A7%E7%8E%AF%E5%A2%83%E4%B8%AD%E8%BF%BD%E8%B8%AA%E8%BF%90%E8%A1%8C%E6%80%81%E5%86%85%E5%AD%98%E5%B4%A9%E6%BA%83%E7%9A%84%E7%AC%AC%E4%B8%80%E7%8E%B0%E5%9C%BA/image2020-1-3_13-50-10.png" srcset="/img/loading.gif" lazyload class=""> 



            </div>
            <hr>
            <div>
              <div class="post-metas mb-3">
                
                  <div class="post-meta mr-3">
                    <i class="iconfont icon-category"></i>
                    
                      <a class="hover-with-bg" href="/categories/devops/">devops</a>
                    
                  </div>
                
                
                  <div class="post-meta">
                    <i class="iconfont icon-tags"></i>
                    
                      <a class="hover-with-bg" href="/tags/c/">c++</a>
                    
                      <a class="hover-with-bg" href="/tags/c/">c</a>
                    
                  </div>
                
              </div>
              
                <p class="note note-warning">
                  
                    本博客所有文章除特别声明外，均采用 <a target="_blank" href="https://creativecommons.org/licenses/by-sa/4.0/deed.zh" rel="nofollow noopener noopener">CC BY-SA 4.0 协议</a> ，转载请注明出处！
                  
                </p>
              
              
                <div class="post-prevnext">
                  <article class="post-prev col-6">
                    
                    
                      <a href="/2023/10/12/04DevOps/27openssl%E7%9B%B8%E5%85%B3%E4%BD%BF%E7%94%A8%E6%96%B9%E6%B3%95%E6%B1%87%E6%80%BB/">
                        <i class="iconfont icon-arrowleft"></i>
                        <span class="hidden-mobile">openssl相关使用方法汇总</span>
                        <span class="visible-mobile">上一篇</span>
                      </a>
                    
                  </article>
                  <article class="post-next col-6">
                    
                    
                      <a href="/2023/08/15/00%E7%AE%97%E6%B3%95%E4%B8%8E%E6%95%B0%E6%8D%AE%E7%BB%93%E6%9E%84/05%E5%9F%BA%E6%95%B0%E6%A0%91(RadixTrie)/">
                        <span class="hidden-mobile">基数树(Radix Trie)</span>
                        <span class="visible-mobile">下一篇</span>
                        <i class="iconfont icon-arrowright"></i>
                      </a>
                    
                  </article>
                </div>
              
            </div>

            
          </article>
        </div>
      </div>
    </div>
    
      <div class="d-none d-lg-block col-lg-2 toc-container" id="toc-ctn">
        <div id="toc">
  <p class="toc-header"><i class="iconfont icon-list"></i>&nbsp;目录</p>
  <div class="toc-body" id="toc-body"></div>
</div>

      </div>
    
  </div>
</div>

<!-- Custom -->


    

    
      <a id="scroll-top-button" aria-label="TOP" href="#" role="button">
        <i class="iconfont icon-arrowup" aria-hidden="true"></i>
      </a>
    

    
      <div class="modal fade" id="modalSearch" tabindex="-1" role="dialog" aria-labelledby="ModalLabel"
     aria-hidden="true">
  <div class="modal-dialog modal-dialog-scrollable modal-lg" role="document">
    <div class="modal-content">
      <div class="modal-header text-center">
        <h4 class="modal-title w-100 font-weight-bold">搜索</h4>
        <button type="button" id="local-search-close" class="close" data-dismiss="modal" aria-label="Close">
          <span aria-hidden="true">&times;</span>
        </button>
      </div>
      <div class="modal-body mx-3">
        <div class="md-form mb-5">
          <input type="text" id="local-search-input" class="form-control validate">
          <label data-error="x" data-success="v"
                 for="local-search-input">关键词</label>
        </div>
        <div class="list-group" id="local-search-result"></div>
      </div>
    </div>
  </div>
</div>
    

    
  </main>

  <footer class="text-center mt-5 py-3">
  <div class="footer-content">
     <a href="https://hexo.io" target="_blank" rel="nofollow noopener"><span>Hexo</span></a> <i class="iconfont icon-love"></i> <a href="https://github.com/fluid-dev/hexo-theme-fluid" target="_blank" rel="nofollow noopener"><span>Fluid</span></a> 
  </div>
  

  

  
</footer>


  <!-- SCRIPTS -->
  
  <script  src="https://cdn.jsdelivr.net/npm/nprogress@0/nprogress.min.js" ></script>
  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/nprogress@0/nprogress.min.css" />

  <script>
    NProgress.configure({"showSpinner":false,"trickleSpeed":100})
    NProgress.start()
    window.addEventListener('load', function() {
      NProgress.done();
    })
  </script>


<script  src="https://cdn.jsdelivr.net/npm/jquery@3/dist/jquery.min.js" ></script>
<script  src="https://cdn.jsdelivr.net/npm/bootstrap@4/dist/js/bootstrap.min.js" ></script>
<script  src="/js/events.js" ></script>
<script  src="/js/plugins.js" ></script>

<!-- Plugins -->


  <script  src="/js/local-search.js" ></script>



  
    <script  src="/js/img-lazyload.js" ></script>
  



  



  
    <script  src="https://cdn.jsdelivr.net/npm/tocbot@4/dist/tocbot.min.js" ></script>
  
  
    <script  src="https://cdn.jsdelivr.net/npm/@fancyapps/fancybox@3/dist/jquery.fancybox.min.js" ></script>
  
  
    <script  src="https://cdn.jsdelivr.net/npm/anchor-js@4/anchor.min.js" ></script>
  
  
    <script defer src="https://cdn.jsdelivr.net/npm/clipboard@2/dist/clipboard.min.js" ></script>
  






  <script  src="https://cdn.jsdelivr.net/npm/typed.js@2/lib/typed.min.js" ></script>
  <script>
    (function (window, document) {
      var typing = Fluid.plugins.typing;
      var title = document.getElementById('subtitle').title;
      
        typing(title);
      
    })(window, document);
  </script>















<!-- 主题的启动项 保持在最底部 -->
<script  src="/js/boot.js" ></script>


</body>
</html>
